S3 buckets should have default encryption enabled using KMS

SSE-S3 encryption uses keys that AWS manages entirely, giving you no control over key rotation schedules, key policies, or access grants. KMS encryption lets you define who can use the key through IAM and KMS key policies, log every decrypt call in CloudTrail, and disable or rotate keys on your own schedule. This separation between the data plane and the key plane is what auditors look for when they evaluate whether you actually control your encryption.

Without KMS, you cannot revoke decryption ability independently of S3 bucket policies. A single overly broad bucket policy could expose plaintext objects with no compensating control.

Implementation

Choose the approach that matches how you manage Terraform.

module "s3_bucket" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "gdpr.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "rbicybersecurity.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "hipaasecurity2003.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nistcsfv11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "pcidssv321.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"

  server_side_encryption_configuration = {
    rule = {
      apply_server_side_encryption_by_default = {
        sse_algorithm = "aws:kms"
      }
    }
  }
}

resource "aws_s3_bucket" "this" {
  bucket        = "pofix-abc123"
  force_destroy = true
}

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = "example-bucket-abc123"
  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
      sse_algorithm     = "aws:kms"
    }
  }
}

What this control checks

This control validates that every aws_s3_bucket has an associated aws_s3_bucket_server_side_encryption_configuration resource where rule.apply_server_side_encryption_by_default.sse_algorithm is "aws:kms" or "aws:kms:dsse". The kms_master_key_id argument must reference a valid KMS key ARN or alias. A bucket passes when SSE-KMS is the default algorithm. It fails if sse_algorithm is "AES256" (SSE-S3) or if the encryption configuration resource is missing entirely. When using "aws:kms", ensure the referenced KMS key policy grants kms:GenerateDataKey and kms:Decrypt to the principals that need to read and write objects.

Common pitfalls

Audit evidence

An auditor expects AWS Config rule evaluation results for S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED (or an equivalent custom rule enforcing KMS-only encryption) showing all buckets as COMPLIANT. Supporting evidence includes the output of aws s3api get-bucket-encryption for each bucket, confirming SSEAlgorithm is aws:kms and KMSMasterKeyID references a specific key ARN. CloudTrail logs should show kms:Decrypt and kms:GenerateDataKey events tied to S3 operations, proving KMS is actively used for object-level encryption.

If a KMS key policy restricts usage, attach a copy of the key policy showing which principals have access. AWS Security Hub compliance findings or third-party scanner output showing bucket encryption status over time strengthen the evidence package.

Related controls

• SageMaker notebook instance encryption should be enabled

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf Control: s3_bucket_default_encryption_enabled_kms

• AWS Config Managed Rule: S3_DEFAULT_ENCRYPTION_KMS

• Checkov Check: CKV_AWS_145

• Powerpipe Control: aws_compliance.control.s3_bucket_default_encryption_enabled_kms

• Prowler Checks: backup_vaults_encrypted, s3_bucket_kms_encryption

• AWS Security Hub Control: S3.17

• Trivy Checks: AWS-0088, AWS-0132

Last reviewed: 2026-03-09